Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of constructing and working Kimwolf<\/strong>, a quick spreading Web-of-Issues botnet that enslaved hundreds of thousands of gadgets to be used in a sequence of huge distributed denial-of-service (DDoS) assaults over the previous six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns in opposition to this writer and a safety researcher. He now faces prison hacking fees in each Canada and the US.<\/p>\n A prison grievance unsealed as we speak in an Alaska district courtroom fees Jacob Butler<\/strong>, a.okay.a. \u201cDort<\/strong>,\u201d of Ottawa, Canada with working the Kimwolf DDoS botnet. A assertion<\/a> from the Division of Justice says the grievance in opposition to Butler was unsealed following the defendant\u2019s arrest in Canada by the Ontario Provincial Police<\/strong> pursuant to a U.S. extradition warrant. Butler is presently in Canadian custody awaiting an preliminary courtroom listening to scheduled for early subsequent week.<\/p>\n The federal government stated Kimwolf focused contaminated gadgets which had been historically \u201cfirewalled\u201d from the remainder of the web, equivalent to digital photograph frames and net cameras. The contaminated methods had been then rented to different cybercriminals, or pressured to take part in record-smashing DDoS assaults, in addition to assaults that affected Web deal with ranges for the Division of Protection<\/strong>. Consequently, the DoD\u2019s Protection Legal Investigative Service<\/strong> is investigating the case, with help from the FBI area workplace in Anchorage.<\/p>\n \u201cKimWolf was tied to DDoS assaults which had been measured at almost 30 Terabits per second, a file in recorded DDoS assault quantity,\u201d the Justice Division assertion reads. \u201cThese assaults resulted in monetary losses which, for some victims, exceeded a million {dollars}. The KimWolf botnet is alleged to have issued over 25,000 assault instructions.\u201d<\/p>\n On March 19, U.S. authorities joined worldwide legislation enforcement companions in seizing the technical infrastructure for Kimwolf<\/a> and three different giant DDoS botnets \u2014 named Aisuru<\/strong>, JackSkid<\/strong> and Mossad<\/strong> \u2014 that had been all competing for a similar pool of susceptible gadgets.<\/p>\n On February 28, KrebsOnSecurity recognized Butler because the Kimwolf botmaster<\/a> after digging by means of his numerous electronic mail addresses, registrations on the cybercrime boards, and posts to public Telegram and Discord servers. Nevertheless, Dort continued to threaten and harass researchers who helped monitor down his real-life identification and dramatically sluggish the unfold of his botnet.<\/p>\n Dort claimed duty for at the least two swatting assaults concentrating on the founding father of Synthient<\/strong>, a safety startup that helped to safe a widespread crucial safety weak spot<\/a> that Kimwolf was utilizing to unfold quicker and extra successfully than every other IoT botnet on the market. Synthient was amongst many expertise corporations thanked by the Justice Division as we speak, and Synthient\u2019s founder Ben Brundage<\/strong> informed KrebsOnSecurity he\u2019s relieved Butler is in custody.<\/p>\n \u201cHopefully this can finish the harassment,\u201d Brundage stated.<\/p>\n An excerpt from the prison grievance in opposition to Butler, detailing how he ordered a swatting assault in opposition to Ben Brundage, the founding father of the safety agency Synthient.<\/p>\n<\/div>\n The federal government says investigators related Butler to the administration of the KimWolf botnet by means of IP deal with, on-line account data, transaction data, and on-line messaging utility data obtained by means of the issuance of authorized course of. The prison grievance in opposition to Butler<\/a> (PDF) exhibits he did little to separate his real-life and cybercriminal identities (one thing we demonstrated in our February unmasking of Dort).<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/05\/dortswat-doj.png\")
<\/p>\n